RootkitRevealer

RootkitRevealer is a program with advanced capabilities to detect rootkit programs. It runs on Windows NT 4 and later versions. The program displays a list of inconsistencies between the results of the file system API and the registry API. These inconsistencies may indicate the presence of a rootkit program running in user or kernel mode.

RootkitRevealer successfully detects all persistent rootkit programs, including AFX, Vanquish, and HackerDefenter. Please note that RootkitRevealder is not designed to detect malware like the Fu program, which does not try to hide its files and registry partitions. Please let us know if you use this program to detect the presence of rootkit programs.

RootkitRevealer is no longer a console program, because malware authors have started to detect the presence of RootkitRevealer by executable file name. The scan is now invoked from a copy of RootkitRevealer with a randomly named file, running as a Windows service. This type of startup makes the process inaccessible from the command line. However, it is possible to use command line options to run an automatic scan with the results of the scan written to a file. This is equivalent to the behavior of the command line version of the program.